Orryn Quote Tracker

Privacy Policy

Version 1.0-draft (QC-035) · Last updated 18 August 2026

This Privacy Policy has been prepared for owner and legal review ahead of public launch. It has not yet received professional legal sign-off -- see the Owner Compliance Checklist. It explains how Orryn Quote Tracker, operated by Adam Wright, trading as Orryn(“Orryn Quote Tracker”, “we”, “us”), collects, uses, shares, retains and protects personal data.

1. Who we are

Orryn Quote Tracker is operated by Adam Wright, trading as Orryn, a UK sole trader. Our public business correspondence address is:

61 Bridge StreetKingtonHR5 3DJUnited Kingdom

For any privacy or data-protection matter, contact us at privacy@orryn.studio.

2. Scope

This policy covers the Orryn Quote Tracker web application, its connected Gmail integration, billing, support and the account data described below. It does not cover third-party websites you may reach through links from Orryn Quote Tracker.

3. Controller and processor roles

Orryn Quote Tracker acts as controller for your direct account relationship with us: your account identity, business settings, subscription and billing records, support correspondence, security/audit records and consent records.

Orryn Quote Tracker acts as processor, on your instructions as the subscribing business, for mailbox and quotation information handled through your connected Gmail account -- your customers’ identities, quotation messages, tracked conversations, attachments, extracted fields and suggested drafts. We do not own or control this data; you (the subscribing business) remain responsible for your own lawful use of your customers’ information, and our processor obligations to you are set out in our Data Processing Terms.

4. What we collect and why

4.1 Account and business data (controller)

  • Sign-in identity and authentication data.
  • Business name, sender display name, sign-off name, timezone, working days/hours (Settings > Business).
  • Notification preferences and Web Push subscription details.
  • Subscription, plan, founder-entitlement, billing-period and payment-method-reference data mirrored from Stripe.
  • Support correspondence you send us.
  • Security, sign-in and administrative audit records.

4.2 Mailbox and quotation data (processor)

  • Sent-mail and tracked-thread messages and attachments relevant to detecting and monitoring quotations.
  • Extracted quotation fields: customer identity, value, currency, status, revisions, events, notes and outcome feedback you record.
  • Draft replies/follow-ups we prepare for your review.

We do not maintain a full mirror of your mailbox. We only process the Sent-mail and tracked-thread content genuinely needed to detect and monitor quotations, and unrelated or rejected mailbox content is not retained indefinitely (see Section 7).

5. Lawful basis for our own (controller) processing

We process account, billing, support and security data to perform our contract with you (providing the subscribed service), to comply with legal obligations (for example, tax and accounting records), and, for security and fraud-prevention records, on the basis of our legitimate interests in keeping the service and its users safe. We do not rely on speculative or unreviewed lawful bases; the exact basis for each processing purpose is flagged in the Owner Compliance Checklist for confirmation during professional legal review.

For mailbox and quotation data, we process as your processor, on your documented instructions as the subscribing business -- see our Data Processing Terms.

6. Gmail / Google data use

Orryn Quote Tracker connects to your Gmail account through Google OAuth with exactly these scopes, and no others:

  • openid — Confirm your identity when you sign in with Google.
  • email — Read your Google account's email address.
  • https://www.googleapis.com/auth/gmail.readonly — Read Sent-mail and tracked-thread messages and attachments to detect and monitor quotations.
  • https://www.googleapis.com/auth/gmail.compose — Create draft replies and follow-ups for you to review -- Orryn Quote Tracker never sends a message automatically.

Orryn Quote Tracker never sends email or a draft on your behalf automatically. Every draft Orryn Quote Tracker prepares is a suggestion you review and send yourself from Gmail. Google user data obtained through these scopes is used only to provide the visible Orryn Quote Tracker features described in this policy and for necessary security or legal operations -- it is never sold, used for advertising, used for unrelated profiling or credit decisions, or used to train general-purpose AI/ML models. Routine human browsing of your Gmail content is prohibited; see our Subprocessors page and Google OAuth Verification Readiness evidence for how this is enforced.

7. AI processing

Orryn Quote Tracker uses AI models from Google Vertex AI to help classify candidate quotation emails, extract quotation fields and draft suggested replies/follow-ups. No production AI credential is active yet -- this describes the intended production configuration, prepared ahead of activation. Only the minimum data each task needs is sent (for example, the message subject, a minimised version of the relevant email text and confirmed quotation fields) -- never your full mailbox, never another customer’s data, and never your private in-app notes. AI outputs are schema-validated and cannot directly send email, change commercial terms, or silently mark a quotation Won or Lost; every draft is a suggestion for your review.

We do not claim zero data retention from our AI provider unless and until the exact production configuration has been verified; see the AI disclosure mapping in QC-035-PRIVACY-LEGAL-SUPPORT-READINESS-REPORT.md for the current evidenced position.

8. Who we share data with

We share personal data only with the service providers and subprocessors genuinely needed to run Orryn Quote Tracker (hosting, database, Gmail integration, billing, AI processing, push notifications and error monitoring), each bound by appropriate contractual terms. See the Subprocessors page for the current list. We do not sell personal data.

9. International transfers

Some of our subprocessors may process data outside the UK/EEA. Where that happens, we rely on the safeguards those providers publish (such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses) -- see each provider’s entry on the Subprocessors page. Exact regions and transfer mechanisms for a given production account are confirmed as part of the Owner Compliance Checklist before launch.

10. How long we keep data

  • Successful temporary processing copies (messages examined but not accepted as quotations): removed within 24 hours where operationally practical.
  • Failed/interrupted processing material: encrypted, kept no more than 7 days for controlled retry.
  • Limited non-content diagnostic/duplicate-prevention metadata: no more than 30 days.
  • After your subscription ends: your account becomes read-only for 90 calendar days, with warnings at approximately 30 and 7 days before automatic deletion.
  • After a confirmed immediate-deletion request: primary operational deletion completes within 30 calendar days, with no recovery window after confirmation.
  • Residual encrypted backup copies: expire within 35 days of deletion from live systems.
  • Routine application/performance logs: 90 days.
  • Authentication, security and administrative audit logs: 12 months.
  • Resolved support correspondence: 24 months.
  • Significant security-incident records: up to 6 years where justified.
  • Segregated billing/tax records: 6 years, or longer only where specifically required by law -- this never justifies retaining Gmail content, quotation documents or customer conversations.

11. Data export

You can request an export of your Orryn Quote Trackerdata at any time while subscribed, during the post-termination read-only period, or before confirming account deletion, from Settings > Account. The export is a secure ZIP of CSV/JSON/explanatory files, excludes credentials, encryption keys, other tenants’ data and security logic, and the download link expires after 7 days.

12. Your rights

Subject to applicable law, you have rights to access, correct, erase, restrict or object to our processing of your personal data, and to data portability. To exercise these rights over your Orryn Quote Tracker account data, email privacy@orryn.studio.

If you are a customer or contact of a business that uses Orryn Quote Tracker (i.e. your details appear in someone else’s connected Gmail account), that business is normally the controller of your information and the right place to exercise your rights directly. Where you contact us instead, we will verify the relevant subscribing business and assist as its processor rather than acting on your request ourselves, unless we are legally required to respond directly.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@orryn.studio. UK residents also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113.

14. Cookies and storage

See our Cookies & Device Storage page for the technologies Orryn Quote Tracker uses and why no cookie consent banner is currently shown.

15. Security

We use encryption in transit and at rest, additional encryption for Gmail credentials, Row Level Security for tenant-owned data, server-side authorisation on privileged operations, and redacted logging that excludes email content, attachment contents and OAuth tokens. We do not publish implementation-level security detail here that could assist an attacker.

To report a suspected security issue, email security@orryn.studio.

16. Certifications

Orryn Quote Tracker does not currently hold formal security or privacy certifications (for example ISO 27001 or SOC 2). We do not claim certifications we do not have.

17. Children

Orryn Quote Tracker is a business tool and is not directed at children.

18. Changes to this policy

We will update the version and date at the top of this page when we make material changes, and will take reasonable steps to notify active account holders of significant changes.

19. Contact

Privacy and data-rights requests: privacy@orryn.studio. General support: support@orryn.studio. Security reports: security@orryn.studio.